[PATCH] Makefile: mrproper deletes signing_key.x509

[PATCH] Makefile: mrproper deletes signing_key.x509

[longguang.yue]

deletes temporary signing_key.x509 and reserves user-defined x509.genkey

Signed-off-by: longguang.yue <bigclouds@163.com>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 37e37565515e..7ad2679fa1ab 100644
--- a/Makefile
+++ b/Makefile
@@ -1589,7 +1589,7 @@ MRPROPER_FILES += include/config include/generated          \
 		  .config .config.old .version \
 		  Module.symvers \
 		  certs/signing_key.pem \
-		  certs/x509.genkey \
+		  certs/signing_key.x509 \
 		  vmlinux-gdb.py \
 		  rpmbuild \
 		  rust/libmacros.so rust/libmacros.dylib
-- 
2.34.1

Re: [PATCH] Makefile: mrproper deletes signing_key.x509

[Nicolas Schier]

On Sat, Aug 09, 2025 at 08:04:05PM +0800 longguang.yue wrote:
> deletes temporary signing_key.x509 and reserves user-defined x509.genkey

can you elaborate the actual problem with some more details?

certs/signing_key.x509 is removed during 'make clean' which is a dependency
of 'mrproper'.

'mrproper' is meant to remove everything that might influence a subsequent
call of kbuild for the sane architecture.

Without further details I cannot see any problem here.

Kind regards,
Nicolas

Re:Re: [PATCH] Makefile: mrproper deletes signing_key.x509

[longguang.yue]

Nicolas Schier, Hi:

  It should not delete x509.genkey because of its exsitence in gitignore.
Normally, users want to keep  a self-defined x509.genkey,  but mrproper deletes it, only default_x509.genkey is effective. 
After applying this patch, users just need to copy self-defined x509.genkey into certs directory once.

Thanks.


At 2025-08-10 04:11:57, "Nicolas Schier" <nicolas.schier@linux.dev> wrote:
>On Sat, Aug 09, 2025 at 08:04:05PM +0800 longguang.yue wrote:
>> deletes temporary signing_key.x509 and reserves user-defined x509.genkey
>
>can you elaborate the actual problem with some more details?
>
>certs/signing_key.x509 is removed during 'make clean' which is a dependency
>of 'mrproper'.
>
>'mrproper' is meant to remove everything that might influence a subsequent
>call of kbuild for the sane architecture.
>
>Without further details I cannot see any problem here.
>
>Kind regards,
>Nicolas

Re: [PATCH] Makefile: mrproper deletes signing_key.x509

[Nicolas Schier]

[-- Attachment #1: Type: text/plain, Size: 1816 bytes --]

Cc: certs/ people

[re-ordered quote]
On Mon, Aug 11, 2025 at 02:28:56PM +0800, longguang.yue wrote:
> At 2025-08-10 04:11:57, "Nicolas Schier" <nicolas.schier@linux.dev> wrote:
> > On Sat, Aug 09, 2025 at 08:04:05PM +0800 longguang.yue wrote:
> > > deletes temporary signing_key.x509 and reserves user-defined x509.genkey
> > 
> > can you elaborate the actual problem with some more details?
> > 
> > certs/signing_key.x509 is removed during 'make clean' which is a dependency
> > of 'mrproper'.
> > 
> > 'mrproper' is meant to remove everything that might influence a subsequent
> > call of kbuild for the sane architecture.
> > 
> > Without further details I cannot see any problem here.
> > 
> > Kind regards,
> > Nicolas
[...]
> 
>   It should not delete x509.genkey because of its exsitence in gitignore.
> Normally, users want to keep  a self-defined x509.genkey,  but mrproper deletes it, only default_x509.genkey is effective. 
> After applying this patch, users just need to copy self-defined x509.genkey into certs directory once.

'make mrproper' is meant to prepare the source tree to be as pristine as 
possible for the given architecture.  This includes removal of any 
configuration file(s) that influence subsequent builds.  From kbuild 
point of view, certs/x509.genkey is also a kind of a configuration file, 
as leaving it in tree after mrproper creates different build results 
compared to a build from a really pristine source tree.

Iff the certs/ maintainers think that retaining a user x509.genkey file 
over a mrproper makes sense, then we should probably adjust the rule for 
generating $(objtree)/certs/x509.genkey, e.g. by allowing to provide one 
by environment variable.

David or David, do you have an opinion on this?

Kind regards,
Nicolas

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] Makefile: mrproper deletes signing_key.x509

[Nathan Chancellor]

On Mon, Aug 11, 2025 at 03:59:23PM +0200, Nicolas Schier wrote:
> Cc: certs/ people
> 
> [re-ordered quote]
> On Mon, Aug 11, 2025 at 02:28:56PM +0800, longguang.yue wrote:
> > At 2025-08-10 04:11:57, "Nicolas Schier" <nicolas.schier@linux.dev> wrote:
> > > On Sat, Aug 09, 2025 at 08:04:05PM +0800 longguang.yue wrote:
> > > > deletes temporary signing_key.x509 and reserves user-defined x509.genkey
> > > 
> > > can you elaborate the actual problem with some more details?
> > > 
> > > certs/signing_key.x509 is removed during 'make clean' which is a dependency
> > > of 'mrproper'.
> > > 
> > > 'mrproper' is meant to remove everything that might influence a subsequent
> > > call of kbuild for the sane architecture.
> > > 
> > > Without further details I cannot see any problem here.
> > > 
> > > Kind regards,
> > > Nicolas
> [...]
> > 
> >   It should not delete x509.genkey because of its exsitence in gitignore.
> > Normally, users want to keep  a self-defined x509.genkey,  but mrproper deletes it, only default_x509.genkey is effective. 
> > After applying this patch, users just need to copy self-defined x509.genkey into certs directory once.
> 
> 'make mrproper' is meant to prepare the source tree to be as pristine as 
> possible for the given architecture.  This includes removal of any 
> configuration file(s) that influence subsequent builds.  From kbuild 
> point of view, certs/x509.genkey is also a kind of a configuration file, 
> as leaving it in tree after mrproper creates different build results 
> compared to a build from a really pristine source tree.

Agreed, I think it is intentional that this is in mrproper and not
clean, so I don't think we can accept this change as is, but I am happy
to be told otherwise from the certs maintainers.

> Iff the certs/ maintainers think that retaining a user x509.genkey file 
> over a mrproper makes sense, then we should probably adjust the rule for 
> generating $(objtree)/certs/x509.genkey, e.g. by allowing to provide one 
> by environment variable.
> 
> David or David, do you have an opinion on this?

Furthermore, if the user wanted to use a predefined x509 configuration,
why can't they generate their own signing key and provide it via
CONFIG_MODULE_SIG_KEY, instead of hijacking the default logic of
certs/signing_key.pem? Based on my reading of certs/Makefile, it sounds
like the default logic is mostly there just for allyesconfig or
randconfig.

Cheers,
Nathan

Re:Re: [PATCH] Makefile: mrproper deletes signing_key.x509

[longguang.yue]

At 2025-08-12 03:14:08, "Nathan Chancellor" <nathan@kernel.org> wrote:
>On Mon, Aug 11, 2025 at 03:59:23PM +0200, Nicolas Schier wrote:
>> Cc: certs/ people
>> 
>> [re-ordered quote]
>> On Mon, Aug 11, 2025 at 02:28:56PM +0800, longguang.yue wrote:
>> > At 2025-08-10 04:11:57, "Nicolas Schier" <nicolas.schier@linux.dev> wrote:
>> > > On Sat, Aug 09, 2025 at 08:04:05PM +0800 longguang.yue wrote:
>> > > > deletes temporary signing_key.x509 and reserves user-defined x509.genkey
>> > > 
>> > > can you elaborate the actual problem with some more details?
>> > > 
>> > > certs/signing_key.x509 is removed during 'make clean' which is a dependency
>> > > of 'mrproper'.
>> > > 
>> > > 'mrproper' is meant to remove everything that might influence a subsequent
>> > > call of kbuild for the sane architecture.
>> > > 
>> > > Without further details I cannot see any problem here.
>> > > 
>> > > Kind regards,
>> > > Nicolas
>> [...]
>> > 
>> >   It should not delete x509.genkey because of its exsitence in gitignore.
>> > Normally, users want to keep  a self-defined x509.genkey,  but mrproper deletes it, only default_x509.genkey is effective. 
>> > After applying this patch, users just need to copy self-defined x509.genkey into certs directory once.
>> 
>> 'make mrproper' is meant to prepare the source tree to be as pristine as 
>> possible for the given architecture.  This includes removal of any 
>> configuration file(s) that influence subsequent builds.  From kbuild 
>> point of view, certs/x509.genkey is also a kind of a configuration file, 
>> as leaving it in tree after mrproper creates different build results 
>> compared to a build from a really pristine source tree.
>
>Agreed, I think it is intentional that this is in mrproper and not
>clean, so I don't think we can accept this change as is, but I am happy
>to be told otherwise from the certs maintainers.
>
>> Iff the certs/ maintainers think that retaining a user x509.genkey file 
>> over a mrproper makes sense, then we should probably adjust the rule for 
>> generating $(objtree)/certs/x509.genkey, e.g. by allowing to provide one 
>> by environment variable.
>> 
>> David or David, do you have an opinion on this?
>
>Furthermore, if the user wanted to use a predefined x509 configuration,
>why can't they generate their own signing key and provide it via
>CONFIG_MODULE_SIG_KEY, instead of hijacking the default logic of
>certs/signing_key.pem? Based on my reading of certs/Makefile, it sounds
>like the default logic is mostly there just for allyesconfig or
>randconfig.
>
>Cheers,
>Nathan

Ok, It needs to copy x509.genkey to certs after mrproper.

As above, signing_key.x509 should be deleted, it denpends on x509.genkey and is a configuration file. 
Adjust this fix to delete signing_key.x509 only, is it acceptable?

Thanks.

Re: [PATCH] Makefile: mrproper deletes signing_key.x509

[David Howells]

Nicolas Schier <nicolas.schier@linux.dev> wrote:

> 'make mrproper' is meant to prepare the source tree to be as pristine as 
> possible for the given architecture.  This includes removal of any 
> configuration file(s) that influence subsequent builds.  From kbuild 
> point of view, certs/x509.genkey is also a kind of a configuration file, 
> as leaving it in tree after mrproper creates different build results 
> compared to a build from a really pristine source tree.
> 
> Iff the certs/ maintainers think that retaining a user x509.genkey file 
> over a mrproper makes sense, then we should probably adjust the rule for 
> generating $(objtree)/certs/x509.genkey, e.g. by allowing to provide one 
> by environment variable.
> 
> David or David, do you have an opinion on this?

make distclean or make mrproper should delete the key.  As you say, it's
thoroughly cleaning out the source tree - it used to be so that you could more
easily diff it for prepping a patch, I guess.  make clean, OTOH, should not.

David